CVE-2024-8673
Published: 15 May 2025
Summary
CVE-2024-8673 is a critical-severity an unspecified weakness vulnerability in Urbanbase Z-Downloads. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 9.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Z-Downloads WordPress plugin before version 1.11.7 contains a file-upload flaw that fails to validate SVG files, allowing those containing embedded malicious JavaScript to be stored on the server. The affected component is the plugin’s upload-handling routine, which accepts untrusted file content without sufficient type or content checks.
An unauthenticated remote attacker can send a crafted SVG directly to the upload endpoint. Successful exploitation yields high-impact effects on confidentiality and integrity, enabling stored cross-site scripting or arbitrary script execution within the WordPress site context, as reflected in the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Public advisories hosted on WPScan document the issue and indicate that the vendor addressed it by releasing version 1.11.7, which restores proper file validation. The associated EPSS score has remained low and essentially flat (current 0.0583, peak 0.0668), providing no indication of emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-15229
Vulnerability details
The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.